Daniel Müller
2010-Aug-09 14:10 UTC
[Samba] HOWTO samba4 centos5.5 named dnsupdate drbd simple failover
centOs5.5/samba4/named here is a short guide setting it up to work.
First of all do not install the bind package coming with centos 5.5!!
Install needs for samba
yum install libacl* gnutls* readline* python* gdb* autoconf*
Named installation:
Here is a description on what to do:
http://jason.roysdon.net/2009/10/16/building-bind-9-6-on-rhel5-centos5-for-d
nssec-nsec3-support/
The steps,
yum -y install make gcc rpm-build libtool autoconf openssl-devel libcap-devel
libidn-devel libxml2-devel openldap-devel postgresql-devel sqlite-devel
mysql-devel krb5-devel xmlto
For named to compile correctly you need this 2 packages too:
yum -y install curl*
download.fedora.redhat.com/pub/fedora/epel/5/i386/python-dns-1.7.1-1.el5.noa
rch.rpm
cd /usr/src/redhat/SRPMS
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/bind-9.6.*.src.rpm
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/dnssec-conf-*.src.rpm
cd /usr/src/redhat/SRPMS
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/12/SRPMS/bind-9.6.*.src.rpm
wget -c
ftp://mirrors.kernel.org/pub/fedora/releases/12/Fedora/source/SRPMS/dnssec-c
onf-*.src.rpm
rpm -ivh --nomd5 bind-9.6.*.src.rpm dnssec-conf-*.src.rpm
cd /usr/src/redhat/SPECS
rpmbuild -ba ./bind.spec
The built bind RPM is now in /usr/src/redhat/RPMS/i386/ or
/usr/src/redhat/RPMS/x86_64/ depending on your Arch.
rpmbuild --ba ./dnssec-conf.spec
The built dnssec-conf RPM is now in /usr/src/redhat/RPMS/noarch/
cd /usr/src/redhat/RPMS/*86*
rpm -Uvh bind-9.6.*.rpm bind-utils-9.6.*.rpm bind-libs-9.6.*.rpm
../noarch/dnssec-conf-1.21-*.noarch.rpm
Now bind is installed Config-File in /etc/named.conf I disabled in options:
//dnssec-enable yes;
//dnssec-validation yes;
//dnssec-lookaside . trust-anchor dlv.isc.org.;
To make bind work you have to add user named to the group named.
Set the rights to make named work correctly
chmod 770 /etc/named.conf
chmod 770 /etc/named.rfc1912.zones
chown root:named /etc/named.conf
chown named:named /etc/named.rfc1912.zones
chmod -R 770 /var/named
chown -R named:named /var/named
chown named:named /etc/rndc.key
chown named:named /var/run/named/
Now download and install samba:
url: http://wiki.samba.org/index.php/Samba4/HOWTO
mkdir samba4
cd samba4
rsync -avz samba.org::ftp/unpacked/samba_4_0_test/ .
cd /source4
./autogen.sh
./configure.devloper
make
make install
Samba4 is now installed in /usr/local/samba
Provision it:
Cd /samba4/source4
./setup/provision --realm=samdom.example.com --domain=SAMDOM
--adminpass=SOMEPASSWORD --server-role='domain controller'
In my case:
./setup/provision --realm=tuebingen.tst.loc
--domain=TUEBINGEN--adminpass=SOMEPASSWORD --server-role='domain
controller'
Now you nedd to add the PATH to roots .bash_profile in /root
--> PATH=$PATH:$HOME/bin:/usr/local/samba/bin:/usr/local/samba/sbin
ldconfig
which samba must answer: /usr/local/samba/sbin/samba
Now you must set the lib paths:
echo "/usr/local/samba/lib" > /etc/ld.so.conf.d/samba4.conf
The next things to do( named should have read and write) :
Cd /usr/local/samba/private
Chown named:named krb5.conf
Chown -R named:named /usr/local/samba/private/dns
Chown named:named named.conf
Chown named:named named.conf.update
Chown named:named dns.keytab
Cp krb5.conf /etc # this will overwrite the org. krb5.conf
cd /etc/sysconfig
Vi named There add a line at the bootom:
KEYTAB_FILE="/usr/local/samba/private/dns.keytab"
export KEYTAB_FILE
Now you must update your /etc/named.conf , Be sure to have em listen on a IP not
only 127.0.0.1:
Here is mine
options {
listen-on port 53 { 127.0.0.1;192.168.134.27; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost;allyoursubnetshere; };
recursion yes;
forwarders { 192.168.134.253; };##put here your first dns if you have };
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/usr/local/samba/private/named.conf";####samba4 link include
"/etc/named.rfc1912.zones";
In your /etc/resolv.conf you have one single entry: ? nameserver localhost
Now you have to put in your globals /usr/local/smba/etc/smb.conf
Interfaces=eth0
Now samba -I -M single
And you are done!!!
Samba_dnsupdate --verbose will give you:
[root at node1 etc]# samba_dnsupdate --verbose Looking for DNS entry A
tuebingen.tst.loc 192.168.134.27 as tuebingen.tst.loc.
Looking for DNS entry A node1.tuebingen.tst.loc 192.168.134.27 as
node1.tuebingen.tst.loc.
Looking for DNS entry CNAME
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc as
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs.tuebingen.tst.loc.
Looking for DNS entry SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 88 as
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc.
Checking 0 100 88 node1.tuebingen.tst.loc. against SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 88
Looking for DNS entry SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 389 as
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc.
The next step setting up the second samba4 on a centOs 5.5 and do replication:
links:http://wiki.samba.org/index.php/Samba4_joining_a_domain
First of all do all the same as for the first centOS samba4 but do not
provision, no smb.conf in /usr/local/samba/etc. Important things: both servers
must new each other.
So if named is installed on the second (node2)you need to tell em in his
named.conf
that the first server(node1) is a forwarder to search for example
?tuebingen.tst.loc?:
Example my named.conf on node2 - 192.168.135.27 is node1,
options {
listen-on port 53 { 127.0.0.1;192.168.134.28; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.135.0/24; 192.168.134.0/24; };
recursion yes;
forwarders { 192.168.134.253;192.168.134.27; };
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
On node2 your /etc/hosts have entries like this:
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
192.168.134.28 node2.local node2
192.168.134.27 node1.tuebingen.tst.loc node1
Now you try ping tuebingen.tst.loc. If it is possible you are on the right way:
ping tuebingen.tst.loc
PING tuebingen.tst.loc (192.168.134.27) 56(84) bytes of data.
64 bytes from node1.tuebingen.tst.loc (192.168.134.27): icmp_seq=1 ttl=64
time=0.138 ms
Now you have to copy your /etc/krb5.conf from node1 to node2 /etc/krb5.conf
scp krb5.conf root at node2:/etc
edit krb5.conf. Make it look like that:
[root at node2 ~]# cat /etc/krb5.conf
[libdefaults]
default_realm = TUEBINGEN.TST.LOC
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
[realms]
TUEBINGEN.TST.LOC = {
kdc = node1.tuebingen.tst.loc:88
admin_server = node1.tuebingen.tst.loc:749
default_domain = tuebingen.tst.loc
}
[domain_realm]
.tuebingen.tst.loc = TUEBINGEN.TST.LOC
tuebingen.tst.loc = TUEBINGEN.TST.LOC
Important is setting dns_lookup_realm=true; dns_lookup_kdc=true
Now a very important thing. On both servers the time must be equal.
So do on both servers: date -s hhmm, ex: date-s 1952.
Then try :
kinit administrator
Password for administrator at TUEBINGEN.TST.LOC:
Must give you this:
Warning: Your password will expire in 34 days on Fri Sep 3 11:11:06 2010
Now change to join domain:
The place to join as dc to your domain is /samba4/source4. There type:
bin/net vampire tuebingen.tst.loc -Uadministrator --realm=tuebingen.tst.loc
If this is successful start samba .
Now return no node1 the first server.
Change to /samba4/source4
Now type: bin/ldbsearch -H /usr/local/samba/private/sam.ldb
objectclass=ntdsdsa objectguid --cross-ncs
This must be the result of two dcs:
[root at node1 source4]# bin/ldbsearch -H /usr/local/samba/private/sam.ldb
objectclass=ntdsdsa objectguid --cross-ncs
# record 1
dn: CN=NTDS
Settings,CN=NODE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tuebingen,DC=tst,DC=loc
objectGUID: 365d2a9f-bfe6-462d-965e-8622bfefc190
# record 2
dn: CN=NTDS
Settings,CN=NODE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tuebingen,DC=tst,DC=loc
objectGUID: d6160c39-0810-4026-aa24-91c91797d892
# returned 2 records
# 2 entries
# 0 referrals
So record 2 is the new dc in the forest.
Now you must update your /usr/local/samba/private/dns/yourzone.list .
Mine after change:
; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@ IN SOA @ hostmaster (
2010072311 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS node1
IN A 192.168.134.27
;
node1 IN A 192.168.134.27
node2 IN A 192.168.134.28 #<----new dc entry
gc._msdcs IN A 192.168.134.27
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs IN CNAME node1
d6160c39-0810-4026-aa24-91c91797d892._msdcs IN CNAME node2 <---new
dc entry
;
; global catalog servers
_gc._tcp IN SRV 0 100 3268 node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 node1
_ldap._tcp.gc._msdcs IN SRV 0 100 3268 node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp IN SRV 0 100 389 node1
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.e67cd6da-dbd0-492d-96e2-2dc778abaebe.domains._msdcs IN SRV 0
100 389 node1
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node1
;
; krb5 servers
_kerberos._tcp IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._udp IN SRV 0 100 88 node1
; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp IN SRV 0 100 88 node1
_kerberos-master._udp IN SRV 0 100 88 node1
;
; kpasswd
_kpasswd._tcp IN SRV 0 100 464 node1
_kpasswd._udp IN SRV 0 100 464 node1
;
; heimdal 'find realm for host' hack
_kerberos IN TXT TUEBINGEN.TST.LOC
(END)
Now you have to put two new entries on node1 /usr/local/samba/etc/smb.conf in
the global section:
dreplsrv:periodic_interval = 10 .
dreplsrv:periodic_startup_interval = 5.
Then ssh in node2 to /usr/local/samba/etc. net vampire has placed there a
smb.conf. There in the global section set this above entries too:
dreplsrv:periodic_interval = 10 .
dreplsrv:periodic_startup_interval = 5.
My globals on node1:
[globals]
netbios name = NODE1
workgroup = TUEBINGEN
realm = TUEBINGEN.TST.LOC
server role = domain controller
interfaces = 192.168.134.27
dreplsrv:periodic_interval = 10
dreplsrv:periodic_startup_interval = 5
My globals on node2:
[globals]
netbios name = NODE2
workgroup = TUEBINGEN
realm = TUEBINGEN.TST.LOC
server role = domain controller
dreplsrv:periodic_interval=10
dreplsrv:periodic_startup_interval=5
Then on Both Servers:
Restart samba
service named restart.
rndc flush.
A litle bit testing:
I put the a user Sammler to my domain using the win7 Domain-Tools:
On second server node2 cd /samba4/source4
then:
bin/ldbsearch -H ldap://node2 -Uadministrator%tornado_11 name='sam*' dn
# record 1
dn: CN=Sammler sm. Sammler,OU=Keine Systemsteuerung,DC=tuebingen,DC=tst,DC=loc
# Referral
ref: ldap://tuebingen.tst.loc/CN=Configuration,DC=tuebingen,DC=tst,DC=loc
# returned 2 records
# 1 entries
# 1 referrals
Step 3: Configure home shares of the users.
This was the greatest try and error. Since samba3 this changed. And it is not
the same in samba4!!!
A simple:
[homes]
path= /home
read only=no
This is all.
All other ACLS is setting from the tool Active Directory Users and Groups
within windows.
Click Start, point to Programs, point to Administrative Tools, and then click
Active Directory Users and Computers.
In the Details pane, right-click the applicable user account, and then click
Properties.
In the Properties dialog box, click the Profile tab.
Under Home folder, type the directory information: In my case ?
\\tuebingen.tst.loc\homes and the tool will make the users directory setting
the correct rights.
Shares: The same for shares you do in your smb.conf
[test]
path= /windows/test
read only= no
Then login as administrator on your win-client. Head to your \\server\test and
give the rights you want for groups or users. This is all.
Step 4. Want some more: make the DATA accessible from both samba PDCs. In case
one is down. This will be real failover while dns is running
#########
We need a second nic for cluster device and drbd.
On node1 this will be: 192.168.130.6.
On nide2 this will be: 192.168.130.5.
You need a second hardisk in my case it will be /dev/hdc.
Set on both node1 und node2.
mkdir /windows.
Fdisk /dev/hdc
Chose n, then p, then 1, then always enter.
Leave with w.
You nedd to install drbd83-8.3.8-1.el5.centos. and
kmod-drbd83-8.3.8-1.el5.centos
yum install *drbd83*
And
yum install cman lvm2-cluster gfs-utils gfs2-utils kmod-gfs
Set up your /etc/drbd.conf:
#drbd.conf dm
global {
usage-count yes;
}
common {
syncer { rate 20M;
al-extents 257;
}
}
resource r0 {
protocol C;
startup {
become-primary-on both;
degr-wfc-timeout 120; # 1 minute.
#wfc-timeout 30;
}
disk {
on-io-error detach;
}
net {
allow-two-primaries;
cram-hmac-alg "sha1";
shared-secret "yourpasswd";
after-sb-0pri discard-least-changes;
#after-sb-0pri discard-zero-changes;
after-sb-1pri violently-as0p;
after-sb-2pri violently-as0p;
#rr-conflict violently;
}
on node2.local {
device /dev/drbd0;
disk /dev/hdc1;
address 192.168.130.5:7788;
flexible-meta-disk internal;
}
on node1.local {
device /dev/drbd0;
disk /dev/hdc1;
address 192.168.130.6:7788;
flexible-meta-disk internal;
}
}
The drbd.conf need to be the same on both hosts!!
Imortant!?with ?on? in your drbd.conf you name your hosts, ex: on node1.local.
After on you must set there the name that gives you ?uname ?n? on your machine.
?r0? ist the resource we are using
According to the /etc/drbd.conf you need to initiate your resource first before
you can use it like: drbdadm create-md r0.
Example:
[root at node2 etc]# drbdadm create-md r0
md_offset 500105211904
al_offset 500105179136
bm_offset 500089913344
Found some data
==> This might destroy existing data! <=
Do you want to proceed?
[need to type 'yes' to confirm] yes
You want me to create a v08 style flexible-size internal meta data block.
There appears to be a v08 flexible-size internal meta data block
already in place on /dev/hdc1 at byte offset 500105211904
Do you really want to overwrite the existing v08 meta-data?
[need to type 'yes' to confirm] yes
Writing meta data...
initializing activity log
NOT initialized bitmap
New drbd meta data block successfully created.
On both nodes: service drbd start
Then: cat /proc/drbd.
[root at node1 ~]# cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at
builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Secondary/Secondary ds:Inconsistent/Inconsistent C r----
ns:0 nr:0 dw:0 dr:0 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:488369056
Then on node1:
drbdadm -- --overwrite-data-of-peer primary all
/cat/proc/drbd will show you:
[root at node1 ~]# cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at
builder10.centos.org, 2010-06-04 08:04:31
0: cs:SyncSource ro:Primary/Secondary ds:UpToDate/Inconsistent C r----
ns:121460 nr:0 dw:0 dr:129632 al:0 bm:7 lo:1 pe:62 ua:256 ap:0 ep:1 wo:b
oos:488249568
[>....................] sync'ed: 0.1% (476804/476920)M
delay_probe: 8
finish: 22:36:14 speed: 5,632 (11,948) K/sec
Now you must wait until both devices synced the first time.
You can ?watch cat /proc/drbd? to see it progress.
After the first sync has finished you will see:
cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at
builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Primary/Secondary ds:UpToDate/UpToDate C r----
ns:488369056 nr:0 dw:0 dr:488369056 al:0 bm:29808 lo:0 pe:0 ua:0 ap:0 ep:1
wo:b oos:0
Now we can configure cluster. This is needed to run both drbd-nodes in primary
mode.
First of all we have to write our /etc/cluster/cluster.conf
<?xml version="1.0" ?>
<cluster config_version="3" name="samba-cluster">
<fence_daemon post_fail_delay="0"
post_join_delay="3"/>
<clusternodes>
<clusternode name="node2" nodeid="1"
votes="1">
<fence>
<method name="single">
<device name="human"
ipaddr="192.168.130.4"/>
</method>
</fence>
</clusternode>
<clusternode name="node1" nodeid="2"
votes="1">
<fence>
<method name="single">
<device name="human"
ipaddr="192.168.130.6"/>
</method>
</fence>
</clusternode>
</clusternodes>
<cman expected_votes="1" two_node="1"/>
<fencedevices>
<fenve_device name="human"
agent="fence_manual"/>
</fencedevices>
<rm>
<failoverdomains/>
<resources/>
</rm>
</cluster>
This cluster.conf must be the same on both node1 and node2. So copy it over:
Ex: scp /etc/cluster/cluster.conf root at node1:/etc/cluster.
Now start cam on both nodes:
cman start.
Now expect this:
[root at node1 cluster]# service cman start
Starting cluster:
Enabling workaround for Xend bridged networking... done
Loading modules... done
Mounting configfs... done
Starting ccsd... done
Starting cman... done
Starting daemons... done
Starting fencing... done
[ OK ]
Now check if all is running well:
Check nodes like this: cman_tool nodes
[root at node1 cluster]# cman_tool nodes
Node Sts Inc Joined Name
1 M 12 2010-08-05 08:37:22 node2
2 M 4 2010-08-05 08:37:22 node1
Now we make our clustered filesystem.
Do it exactly like that:
Now first on node1:
For this we need the name of our cluster in cluster.conf, ?samba-cluster?, and
?/dev/drbd0?.
mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0.
[root at node1 cluster]# mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2
/dev/drbd0
This will destroy any data on /dev/drbd0.
Are you sure you want to proceed? [y/n]
Device: /dev/drbd0
Blocksize: 4096
Device Size 465.75 GB (122092264 blocks)
Filesystem Size: 465.75 GB (122092262 blocks)
Journals: 2
Resource Groups: 1863
Locking Protocol: "lock_dlm"
Lock Table: "samba-cluster:gfs2"
UUID: BBAF2EC1-B0B8-0F82-DB5C-CA9273859610
Then service gfs start.
Then change on node2. Remember this node runs in drbd ?secondary?. So we have to
put it on primary.
On node2:
drbdadm primary r0.
A cat /proc/drbd must show us:
cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at
builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Primary/Primary ds:UpToDate/UpToDate C r----
ns:0 nr:488671336 dw:488671336 dr:0 al:0 bm:29808 lo:0 pe:0 ua:0 ap:0 ep:1
wo:b oos:0
Now we can make on node2 our clustered filesystem:
[root at node2 ~]# mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0
This will destroy any data on /dev/drbd0.
It appears to contain a gfs2 filesystem.
Are you sure you want to proceed? [y/n]
Device: /dev/drbd0
Blocksize: 4096
Device Size 465.75 GB (122092264 blocks)
Filesystem Size: 465.75 GB (122092262 blocks)
Journals: 2
Resource Groups: 1863
Locking Protocol: "lock_dlm"
Lock Table: "samba-cluster:gfs2"
UUID: 885E2E87-90CE-B916-8A73-D66336CD98C0
Now start on node2 gfs: service gfs start.
No make on both nodes in / the directory windows: mkdir windows.
Then mount on both nodes the gfs filesystem to windows:
mount -t gfs2 /dev/drbd0 /windows.
Now lets do testing, on nod1:
cd /windows.
touch test.txt
[root at node1 windows]# ls
test.txt
On node2 you must see in /windows:
[root at node2 windows]# ls
test.txt.
On node2: vim test.txt, i, this is a test from node2,:, wq.
On node1: /cat/windows/test.txt
[root at node1 windows]# cat /windows/test.txt
this is a test from node2
So you did it. Everything is synchronized.
So you point hour home-directories and your shares in
/usr/local/samba/etc/smb.conf to a directory in windows and you have a failover
Data for your both samba4 controllers.
The next thing to do is to add entries into fstab on both nodes :
vim /etc/fstab
Enter: /dev/drbd0 /windows gfs2 _netdev 0 0
At the end.
This is my fstab:
/dev/VolGroup00/LogVol00 / ext3 defaults 1 1
LABEL=/boot /boot ext3 defaults 1 2
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
/dev/VolGroup00/LogVol01 swap swap defaults 0 0
/dev/drbd0 /windows gfs2 _netdev 0 0
The next step is to make shure DRBD is started on boot before GFS2. In my case I
tried several hours befor I succeeded. You must do this on both nodes.
You find the startup scripts in /etc/rc.d/init.d.
First drbd: vim drbd. You find the start and stop option at #chkconfig_ - start
stop.
The original line here: #chkconfig: - 70 08. I changed it to: # chkconfig: - 55
08
#!/bin/bash
#
# chkconfig: - 55 08
# description: Loads and unloads the drbd module
#
# Copyright 2001-2010 LINBIT
#
# Philipp Reisner, Lars Ellenberg
#
### BEGIN INIT INFO
# Provides: drbd
# Required-Start: $local_fs $network $syslog
# Required-Stop: $local_fs $network $syslog
# Should-Start: sshd multipathd
# Should-Stop: sshd multipathd
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# X-Start-Before: heartbeat corosync
# X-Stop-After: heartbeat corosync
# Short-Description: Control drbd resources.
### END INIT INFO
Now vim gfs2:
The original line here: #chkconfig: - 26 74. I changed it to: # chkconfig: - 70
07
#!/bin/bash
#
#
#
# chkconfig: - 70 07
# description: mount/unmount gfs2 filesystems configured in /etc/fstab
#
#
### BEGIN INIT INFO
# Provides:
### END INIT INFO
:q
:
Now cd /etc/rc.d/rc5.d.
mv S26gfs2 S70gfs2
mv S70drbd S55drbd
in all other rc0.d-rc4.d and rc.6.d, mv K74gfs2 K07gfs2
Now restart both nodes.
Mkdir /windows/homes on both nodes.Point your [homes] in
/usr/local/samba/etc/smb.conf to path= /windows/homes:
[homes]
path= /windows/homes
read only=no
Make as described in Step3: Add home derictories and rights. You will find your
files synchronized on both node1 und node2
Now important to make your simple failover work you have to tune your named
server on node1:
This are the entries for your /usr/local/samba/private/dns/yourdomianzone
EX mine : /usr/local/samba/private/dns/tuebingen.tst.loc.zone
Change it according your settings:
; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@ IN SOA @ hostmaster (
2010080911 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS node1
IN A 192.168.134.27
IN A 192.168.134.28
;192.168.134.28 eingefuegt
;
node1 IN A 192.168.134.27
node2 IN A 192.168.134.28
gc._msdcs IN A 192.168.134.27
13ff0be8-50f6-45b8-858e-9a38872906e0._msdcs IN CNAME node1
aaf6380d-162e-4263-86b2-c4119457342c._mscds IN CNAME node2
;
; global catalog servers
_gc._tcp IN SRV 0 100 3268 node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 node1
_ldap._tcp.gc._msdcs IN SRV 0 100 3268 node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp IN SRV 0 100 389 node1
_ldap._tcp IN SRV 0 100 389 node2
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node2
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node1
;von mir eingefuegt
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node2
;ende
_ldap._tcp.fac1d707-a9a9-44a2-8b02-4ab6dda8cec7.domains._msdcs IN SRV 0
100 389 node1
_ldap._tcp.fac1d707-a9a9-44a2-8b02-4ab6dda8cec7.domains._msdcs IN SRV 0
100 389 node2
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node2
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node2
;
; krb5 servers
_kerberos._tcp IN SRV 0 100 88 node1
_kerberos._tcp IN SRV 0 100 88 node2
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node2
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node2
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node2
_kerberos._udp IN SRV 0 100 88 node1
_kerberos._udp IN SRV 0 100 88 node2
; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp IN SRV 0 100 88 node1
_kerberos-master._tcp IN SRV 0 100 88 node2
_kerberos-master._udp IN SRV 0 100 88 node1
_kerberos-master._udp IN SRV 0 100 88 node2
;
; kpasswd
_kpasswd._tcp IN SRV 0 100 464 node1
_kpasswd._tcp IN SRV 0 100 464 node2
_kpasswd._udp IN SRV 0 100 464 node1
_kpasswd._udp IN SRV 0 100 464 node2
;
; heimdal 'find realm for host' hack
_kerberos IN TXT TUEBINGEN.TST.LOC
-----------------------------------------------
EDV Daniel M?ller
Leitung EDV
Tropenklinik Paul-Lechler-Krankenhaus
Paul-Lechler-Str. 24
72076 T?bingen
Tel.: 07071/206-463, Fax: 07071/206-499
eMail: mueller at tropenklinik.de
Internet: www.tropenklinik.de
-----------------------------------------------
Nico Kadel-Garcia
2010-Aug-11 00:22 UTC
[Samba] HOWTO samba4 centos5.5 named dnsupdate drbd simple failover
On Mon, Aug 9, 2010 at 10:10 AM, Daniel M?ller <mueller at tropenklinik.de> wrote:> > centOs5.5/samba4/named ?here is a short guide setting it up to work. > First of all do not install the bind package coming with centos 5.5!! > > Install needs for samba > > yum install libacl* ?gnutls* readline* python* gdb* autoconf* > > Named installation: > Here is a description on what to do: > http://jason.roysdon.net/2009/10/16/building-bind-9-6-on-rhel5-centos5-for-d > nssec-nsec3-support/ > The steps,Thanks for the pointer. I do have some strong suggestions for you. * Never build RPM's as root. Always do them as a user. This takes setting up your $HOME/.rpmmacros, but it's far safer and helps prevent badly written or erroneous .spec files from accidentally doing "rm -rf /" or modifying your installed system files. (I just published patches to an upstream package maintainer to prevent exactly this sort of accidental local modification in the build process.) I'd be happy to publish notes for it. * If possible, build RPM's with the "mock" tool. This assures that you're building them with a clean build environment, rather than with locally modified libraries, or if you need local modifications you've identified them all. Again, I'd be happy to publish notes.> yum -y install make gcc rpm-build libtool autoconf openssl-devel libcap-devel libidn-devel libxml2-devel openldap-devel postgresql-devel sqlite-devel mysql-devel krb5-devel xmltoSimply doing "yum -y insall rpmbuild", then "rpmbuild --rebuild samba-*.src.rpm" should identify the dependencies for the existing samba packages or any *.src.rpm you work with.> For named to compile correctly you need this 2 packages too: > > yum -y install curl* > > download.fedora.redhat.com/pub/fedora/epel/5/i386/python-dns-1.7.1-1.el5.noa > rch.rpmEPEL is great, and also available at ftp://mirrors.kernel.org/fedora-epel/5/. And whether to use i386 or x86_64 depends on your architecture. And EPEL changes versions and discards old ones without announcements, so your needed tool may change behind you back.. Better to install the 'epel-release" RPM from the same repository, and disable the /etc/yum.repos.d/epel.repo if you don't want it on by default, but use it as needed to more gracefully install and update such packages. Also, "dnssec-conf" has been obsoleted in the EPEL repository by "unbound", which I assume will also work.> cd /usr/src/redhat/SRPMS > wget -c > ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/bind-9.6.*.src.rpm > wget -c > ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/dnssec-conf-*.src.rpm > > > cd /usr/src/redhat/SRPMS > wget -c > ftp://mirrors.kernel.org/pub/fedora/updates/12/SRPMS/bind-9.6.*.src.rpm > wget -c > ftp://mirrors.kernel.org/pub/fedora/releases/12/Fedora/source/SRPMS/dnssec-c > onf-*.src.rpm > rpm -ivh --nomd5 bind-9.6.*.src.rpm dnssec-conf-*.src.rpmFedora 13 is out. But this doesn't work with either Fedora 12 or 13 packages, unless you've separately updated your RPM to be compatible with current Fedora releases. That's fairly awkward to do. To work around that, you need to extract the files and drop them ni place manually. If you use .rpmmacros, it looks like this: cd $HOME/rpm/SOURCES for name in ../SRPMS/bind-9.6.*.src.rpm rpm2cpio $name | cpio -i mv bind.spec ../SPECS/bind.spec rpmbuild -bs --nodeps ../SPECS/bind.spec done rpmbuild -bs --nodeps rpmbuild --rebuild ../SRPMS/bind-9.6-[whatever].el5.src.rpm> cd /usr/src/redhat/SPECS > rpmbuild -ba ./bind.spec > > The built bind RPM is now in /usr/src/redhat/RPMS/i386/ or /usr/src/redhat/RPMS/x86_64/ depending on your Arch. > > rpmbuild --ba ./dnssec-conf.spec > > The built dnssec-conf RPM is now in /usr/src/redhat/RPMS/noarch/Which is now unnecessary, due to the availability of dnssec-conf's successor in EPEL.> cd /usr/src/redhat/RPMS/*86* > rpm -Uvh bind-9.6.*.rpm bind-utils-9.6.*.rpm bind-libs-9.6.*.rpm ../noarch/dnssec-conf-1.21-*.noarch.rpm > > Now bind is installed Config-File in /etc/named.conf I disabled in options: > //dnssec-enable yes; > //dnssec-validation yes; > //dnssec-lookaside . trust-anchor dlv.isc.org.; > > To make bind work you have to add user named to the group named. > Set the rights to make named work correctly > chmod 770 /etc/named.conf > chmod 770 /etc/named.rfc1912.zones > chown root:named /etc/named.conf > chown named:named /etc/named.rfc1912.zones > chmod -R 770 /var/named > chown -R named:named /var/named > chown named:named /etc/rndc.key > chown named:named /var/run/named/named is already there from your installations of the bind RPM. Look in the '%post' commands. I'm going to take a break here, before getting into building Samba 4 itself. While your guidelines are helpful, I'm afraid they're off the beaten path for RPM based installations, and I'd like to encourage you to update them.
Daniel Müller
2010-Aug-24 14:31 UTC
[Samba] HOWTO samba4 centos5.5 named dnsupdate drbd simple failover
centOs5.5/samba4/named here is a short guide setting it up to work.
This Version is with some minor adds about profiles.
First of all do not install the bind package coming with centos 5.5!!
Install needs for samba
yum install libacl* gnutls* readline* python* gdb* autoconf*
Named installation:
Here is a description on what to do:
http://jason.roysdon.net/2009/10/16/building-bind-9-6-on-rhel5-centos5-for-d
nssec-nsec3-support/
The steps,
yum -y install make gcc rpm-build libtool autoconf openssl-devel libcap-devel
libidn-devel libxml2-devel openldap-devel postgresql-devel sqlite-devel
mysql-devel krb5-devel xmlto
For named to compile correctly you need this 2 packages too:
yum -y install curl*
download.fedora.redhat.com/pub/fedora/epel/5/i386/python-dns-1.7.1-1.el5.noa
rch.rpm
cd /usr/src/redhat/SRPMS
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/bind-9.6.*.src.rpm
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/11/SRPMS/dnssec-conf-*.src.rpm
cd /usr/src/redhat/SRPMS
wget -c
ftp://mirrors.kernel.org/pub/fedora/updates/12/SRPMS/bind-9.6.*.src.rpm
wget -c
ftp://mirrors.kernel.org/pub/fedora/releases/12/Fedora/source/SRPMS/dnssec-c
onf-*.src.rpm
rpm -ivh --nomd5 bind-9.6.*.src.rpm dnssec-conf-*.src.rpm
cd /usr/src/redhat/SPECS
rpmbuild -ba ./bind.spec
The built bind RPM is now in /usr/src/redhat/RPMS/i386/ or
/usr/src/redhat/RPMS/x86_64/ depending on your Arch.
rpmbuild --ba ./dnssec-conf.spec
The built dnssec-conf RPM is now in /usr/src/redhat/RPMS/noarch/
cd /usr/src/redhat/RPMS/*86*
rpm -Uvh bind-9.6.*.rpm bind-utils-9.6.*.rpm bind-libs-9.6.*.rpm
../noarch/dnssec-conf-1.21-*.noarch.rpm
Now bind is installed Config-File in /etc/named.conf I disabled in options:
//dnssec-enable yes;
//dnssec-validation yes;
//dnssec-lookaside . trust-anchor dlv.isc.org.;
To make bind work you have to add user named to the group named.
Set the rights to make named work correctly
chmod 770 /etc/named.conf
chmod 770 /etc/named.rfc1912.zones
chown root:named /etc/named.conf
chown named:named /etc/named.rfc1912.zones
chmod -R 770 /var/named
chown -R named:named /var/named
chown named:named /etc/rndc.key
chown named:named /var/run/named/
Now download and install samba:
url: http://wiki.samba.org/index.php/Samba4/HOWTO
mkdir samba4
cd samba4
rsync -avz samba.org::ftp/unpacked/samba_4_0_test/ .
cd /source4
./autogen.sh
./configure.devloper
make
make install
Samba4 is now installed in /usr/local/samba
Provision it:
Cd /samba4/source4
./setup/provision --realm=samdom.example.com --domain=SAMDOM
--adminpass=SOMEPASSWORD --server-role='domain controller'
In my case:
./setup/provision --realm=tuebingen.tst.loc
--domain=TUEBINGEN--adminpass=SOMEPASSWORD --server-role='domain
controller'
Now you nedd to add the PATH to roots .bash_profile in /root
--> PATH=$PATH:$HOME/bin:/usr/local/samba/bin:/usr/local/samba/sbin
ldconfig
which samba must answer: /usr/local/samba/sbin/samba
Now you must set the lib paths:
echo "/usr/local/samba/lib" > /etc/ld.so.conf.d/samba4.conf
The next things to do( named should have read and write) :
Cd /usr/local/samba/private
Chown named:named krb5.conf
Chown -R named:named /usr/local/samba/private/dns
Chown named:named named.conf
Chown named:named named.conf.update
Chown named:named dns.keytab
Cp krb5.conf /etc # this will overwrite the org. krb5.conf
cd /etc/sysconfig
Vi named There add a line at the bootom:
KEYTAB_FILE="/usr/local/samba/private/dns.keytab"
export KEYTAB_FILE
Now you must update your /etc/named.conf , Be sure to have em listen on a IP not
only 127.0.0.1:
Here is mine
options {
listen-on port 53 { 127.0.0.1;192.168.134.27; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost;allyoursubnetshere; };
recursion yes;
forwarders { 192.168.134.253; };##put here your first dns if you have };
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/usr/local/samba/private/named.conf";####samba4 link include
"/etc/named.rfc1912.zones";
In your /etc/resolv.conf you have one single entry: ? nameserver localhost
Now you have to put in your globals /usr/local/smba/etc/smb.conf
Interfaces=eth0 # or Ipaddress
Now samba -I -M single
And you are done!!!
Samba_dnsupdate --verbose will give you:
[root at node1 etc]# samba_dnsupdate --verbose Looking for DNS entry A
tuebingen.tst.loc 192.168.134.27 as tuebingen.tst.loc.
Looking for DNS entry A node1.tuebingen.tst.loc 192.168.134.27 as
node1.tuebingen.tst.loc.
Looking for DNS entry CNAME
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc as
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs.tuebingen.tst.loc.
Looking for DNS entry SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 88 as
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc.
Checking 0 100 88 node1.tuebingen.tst.loc. against SRV
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 88
Looking for DNS entry SRV
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc
node1.tuebingen.tst.loc 389 as
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.tuebingen.tst.loc.
The next step setting up the second samba4 on a centOs 5.5 and do replication:
links:http://wiki.samba.org/index.php/Samba4_joining_a_domain
First of all do all the same as for the first centOS samba4 but do not
provision, no smb.conf in /usr/local/samba/etc. Important things: both servers
must new each other.
So if named is installed on the second (node2)you need to tell em in his
named.conf
that the first server(node1) is a forwarder to search for example
?tuebingen.tst.loc?:
Example my named.conf on node2 - 192.168.135.27 is node1,
options {
listen-on port 53 { 127.0.0.1;192.168.134.28; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.135.0/24; 192.168.134.0/24; };
recursion yes;
forwarders { 192.168.134.253;192.168.134.27; };
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
include "/etc/named.rfc1912.zones";
On node2 your /etc/hosts have entries like this:
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1 localhost.localdomain localhost
::1 localhost6.localdomain6 localhost6
192.168.134.28 node2.local node2
192.168.134.27 node1.tuebingen.tst.loc node1
Now you try ping tuebingen.tst.loc. If it is possible you are on the right way:
ping tuebingen.tst.loc
PING tuebingen.tst.loc (192.168.134.27) 56(84) bytes of data.
64 bytes from node1.tuebingen.tst.loc (192.168.134.27): icmp_seq=1 ttl=64
time=0.138 ms
Now you have to copy your /etc/krb5.conf from node1 to node2 /etc/krb5.conf
scp krb5.conf root at node2:/etc
edit krb5.conf. Make it look like that:
[root at node2 ~]# cat /etc/krb5.conf
[libdefaults]
default_realm = TUEBINGEN.TST.LOC
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes
[realms]
TUEBINGEN.TST.LOC = {
kdc = node1.tuebingen.tst.loc:88
admin_server = node1.tuebingen.tst.loc:749
default_domain = tuebingen.tst.loc
}
[domain_realm]
.tuebingen.tst.loc = TUEBINGEN.TST.LOC
tuebingen.tst.loc = TUEBINGEN.TST.LOC
Important is setting dns_lookup_realm=true; dns_lookup_kdc=true
Now a very important thing. On both servers the time must be equal.
So do on both servers: date -s hhmm, ex: date-s 1952.
Then try :
kinit administrator
Password for administrator at TUEBINGEN.TST.LOC:
Must give you this:
Warning: Your password will expire in 34 days on Fri Sep 3 11:11:06 2010
Now change to join domain:
The place to join as dc to your domain is /samba4/source4. There type:
bin/net vampire tuebingen.tst.loc -Uadministrator --realm=tuebingen.tst.loc
If this is successful start samba .
Now return no node1 the first server.
Change to /samba4/source4
Now type: bin/ldbsearch -H /usr/local/samba/private/sam.ldb
objectclass=ntdsdsa objectguid --cross-ncs
This must be the result of two dcs:
[root at node1 source4]# bin/ldbsearch -H /usr/local/samba/private/sam.ldb
objectclass=ntdsdsa objectguid --cross-ncs
# record 1
dn: CN=NTDS
Settings,CN=NODE1,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tuebingen,DC=tst,DC=loc
objectGUID: 365d2a9f-bfe6-462d-965e-8622bfefc190
# record 2
dn: CN=NTDS
Settings,CN=NODE2,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=tuebingen,DC=tst,DC=loc
objectGUID: d6160c39-0810-4026-aa24-91c91797d892
# returned 2 records
# 2 entries
# 0 referrals
So record 2 is the new dc in the forest.
Now you must update your /usr/local/samba/private/dns/yourzone.list .
Mine after change:
; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@ IN SOA @ hostmaster (
2010072311 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS node1
IN A 192.168.134.27
;
node1 IN A 192.168.134.27
node2 IN A 192.168.134.28 #<----new dc entry
gc._msdcs IN A 192.168.134.27
365d2a9f-bfe6-462d-965e-8622bfefc190._msdcs IN CNAME node1
d6160c39-0810-4026-aa24-91c91797d892._msdcs IN CNAME node2 <---new
dc entry
;
; global catalog servers
_gc._tcp IN SRV 0 100 3268 node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 node1
_ldap._tcp.gc._msdcs IN SRV 0 100 3268 node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp IN SRV 0 100 389 node1
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.e67cd6da-dbd0-492d-96e2-2dc778abaebe.domains._msdcs IN SRV 0
100 389 node1
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node1
;
; krb5 servers
_kerberos._tcp IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._udp IN SRV 0 100 88 node1
; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp IN SRV 0 100 88 node1
_kerberos-master._udp IN SRV 0 100 88 node1
;
; kpasswd
_kpasswd._tcp IN SRV 0 100 464 node1
_kpasswd._udp IN SRV 0 100 464 node1
;
; heimdal 'find realm for host' hack
_kerberos IN TXT TUEBINGEN.TST.LOC
(END)
Now you have to put two new entries on node1 /usr/local/samba/etc/smb.conf in
the global section:
dreplsrv:periodic_interval = 10 .
dreplsrv:periodic_startup_interval = 5.
Then ssh in node2 to /usr/local/samba/etc. net vampire has placed there a
smb.conf. There in the global section set this above entries too:
dreplsrv:periodic_interval = 10 .
dreplsrv:periodic_startup_interval = 5.
My globals on node1:
[globals]
netbios name = NODE1
workgroup = TUEBINGEN
realm = TUEBINGEN.TST.LOC
server role = domain controller
interfaces = 192.168.134.27
dreplsrv:periodic_interval = 10
dreplsrv:periodic_startup_interval = 5
My globals on node2:
[globals]
netbios name = NODE2
workgroup = TUEBINGEN
realm = TUEBINGEN.TST.LOC
server role = domain controller
dreplsrv:periodic_interval=10
dreplsrv:periodic_startup_interval=5
Then on Both Servers:
Restart samba
service named restart.
rndc flush.
A litle bit testing:
I put the a user Sammler to my domain using the win7 Domain-Tools:
On second server node2 cd /samba4/source4
then:
bin/ldbsearch -H ldap://node2 -Uadministrator%tornado_11 name='sam*' dn
# record 1
dn: CN=Sammler sm. Sammler,OU=Keine Systemsteuerung,DC=tuebingen,DC=tst,DC=loc
# Referral
ref: ldap://tuebingen.tst.loc/CN=Configuration,DC=tuebingen,DC=tst,DC=loc
# returned 2 records
# 1 entries
# 1 referrals
Step 3: Configure home shares of the users.
This was the greatest try and error. Since samba3 this changed. And it is not
the same in samba4!!!
A simple:
[homes]
path= /home
read only=no
This is all.
All other ACLS is setting from the tool Active Directory Users and Groups
within windows.
Click Start, point to Programs, point to Administrative Tools, and then click
Active Directory Users and Computers.
In the Details pane, right-click the applicable user account, and then click
Properties.
In the Properties dialog box, click the Profile tab.
Under Home folder, type the directory information: In my case ?
\\tuebingen.tst.loc\homes and the tool will make the users directory setting
the correct rights.
Shares: The same for shares you do in your smb.conf
[test]
path= /windows/test
read only= no
Then login as administrator on your win-client. Head to your \\server\test and
give the rights you want for groups or users. This is all.
Password Policy Settings!!
Along with Samba4 the Password Policy you can only set from console, with
'net pwsettings ' command.
net pwsettings ?help:
usage: (show | set <options>)
options:
-h, --help show this help message and exit
-H H LDB URL for database or target server
--quiet Be quiet
--complexity=COMPLEXITY
The password complexity (on | off | default). Default
is 'on'
--history-length=HISTORY_LENGTH
The password history length (<integer> | default).
Default is 24.
--min-pwd-length=MIN_PWD_LENGTH
The minimum password length (<integer> | default).
Default is 7.
--min-pwd-age=MIN_PWD_AGE
The minimum password age (<integer in days> |
default). Default is 1.
--max-pwd-age=MAX_PWD_AGE
The maximum password age (<integer in days> |
default). Default is 43.
Samba Common Options:
-s FILE, --configfile=FILE
Configuration file
-d DEBUGLEVEL, --debuglevel=DEBUGLEVEL
debug level
--option=OPTION set smb.conf option from command line
--realm=REALM set the realm name
Credentials Options:
--simple-bind-dn=DN
DN to use for a simple bind
--password=PASSWORD
Password
-U USERNAME, --username=USERNAME
Username
-W WORKGROUP, --workgroup=WORKGROUP
Workgroup
-N, --no-pass Don't ask for a password
-k KERBEROS, --kerberos=KERBEROS
Use Kerberos
Version Options:
--version Display version number
So I set my Password Policy:
net pwsettings set ?--complexity=off
net pwsettings set ---max-pwd-age=60 #<---60 Days
net pwsettings set ?min-pwd-length=5
net pwsettings show:
[root at node1 ~]# net pwsettings show
Password informations for domain 'DC=tuebingen,DC=tst,DC=loc'
Password complexity: off
Password history length: 24
Minimum password length: 5
Minimum password age (days): 1
Maximum password age (days): 60
Make profiles ready:
In your smb.conf:
[profiles]
path= /windows/users/profiles
read only= no
mkdir /windows/users/profiles
On your windows client start Active Directory Users and Comupters. Right
click,properties, then profil tab: Profile path: Your path to the profiles along
with %Username%
EX: \\tuebingen.tst.loc\profiles\%USERNAME%
Step 4. Want some more: make the DATA accessible from both samba PDCs. In case
one is down. This will be real failover while dns is running
#########
We need a second nic for cluster device and drbd
On node1 this will be: 192.168.130.6
On nide2 this will be: 192.168.130.5
You need a second hardisk in my case it will be /dev/hdc
Set on both node1 und node2
mkdir /windows.
Fdisk /dev/hdc
Chose n, then p, then 1, then always enter.
Leave with w.
You nedd to install drbd83-8.3.8-1.el5.centos. and
kmod-drbd83-8.3.8-1.el5.centos
yum install *drbd83*
And
yum install cman lvm2-cluster gfs-utils gfs2-utils kmod-gfs
Set up your /etc/drbd.conf:
#drbd.conf dm
global {
usage-count yes;
}
common {
syncer { rate 20M;
al-extents 257;
}
}
resource r0 {
protocol C;
startup {
become-primary-on both;
degr-wfc-timeout 120; # 1 minute.
#wfc-timeout 30;
}
disk {
on-io-error detach;
}
net {
allow-two-primaries;
cram-hmac-alg "sha1";
shared-secret "yourpasswd";
after-sb-0pri discard-least-changes;
#after-sb-0pri discard-zero-changes;
after-sb-1pri violently-as0p;
after-sb-2pri violently-as0p;
#rr-conflict violently;
}
on node2.local {
device /dev/drbd0;
disk /dev/hdc1;
address 192.168.130.5:7788;
flexible-meta-disk internal;
}
on node1.local {
device /dev/drbd0;
disk /dev/hdc1;
address 192.168.130.6:7788;
flexible-meta-disk internal;
}
}
The drbd.conf need to be the same on both hosts!!
Imortant!?with ?on? in your drbd.conf you name your hosts, ex: on node1.local.
After on you must set there the name that gives you ?uname ?n? on your machine.
?r0? ist the resource we are using
According to the /etc/drbd.conf you need to initiate your resource first before
you can use it like: drbdadm create-md r0.
Example:
[root at node2 etc]# drbdadm create-md r0
md_offset 500105211904
al_offset 500105179136
bm_offset 500089913344
Found some data
==> This might destroy existing data! <=
Do you want to proceed?
[need to type 'yes' to confirm] yes
You want me to create a v08 style flexible-size internal meta data block.
There appears to be a v08 flexible-size internal meta data block
already in place on /dev/hdc1 at byte offset 500105211904
Do you really want to overwrite the existing v08 meta-data?
[need to type 'yes' to confirm] yes
Writing meta data...
initializing activity log
NOT initialized bitmap
New drbd meta data block successfully created.
On both nodes: service drbd start
Then: cat /proc/drbd.
[root at node1 ~]# cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at
builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Secondary/Secondary ds:Inconsistent/Inconsistent C r----
ns:0 nr:0 dw:0 dr:0 al:0 bm:0 lo:0 pe:0 ua:0 ap:0 ep:1 wo:b oos:488369056
Then on node1:
drbdadm -- --overwrite-data-of-peer primary all
/cat/proc/drbd will show you:
[root at node1 ~]# cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at
builder10.centos.org, 2010-06-04 08:04:31
0: cs:SyncSource ro:Primary/Secondary ds:UpToDate/Inconsistent C r----
ns:121460 nr:0 dw:0 dr:129632 al:0 bm:7 lo:1 pe:62 ua:256 ap:0 ep:1 wo:b
oos:488249568
[>....................] sync'ed: 0.1% (476804/476920)M
delay_probe: 8
finish: 22:36:14 speed: 5,632 (11,948) K/sec
Now you must wait until both devices synced the first time.
You can ?watch cat /proc/drbd? to see it progress.
After the first sync has finished you will see:
cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at
builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Primary/Secondary ds:UpToDate/UpToDate C r----
ns:488369056 nr:0 dw:0 dr:488369056 al:0 bm:29808 lo:0 pe:0 ua:0 ap:0 ep:1
wo:b oos:0
Now we can configure cluster. This is needed to run both drbd-nodes in primary
mode.
First of all we have to write our /etc/cluster/cluster.conf
<?xml version="1.0" ?>
<cluster config_version="3" name="samba-cluster">
<fence_daemon post_fail_delay="0"
post_join_delay="3"/>
<clusternodes>
<clusternode name="node2" nodeid="1"
votes="1">
<fence>
<method name="single">
<device name="human"
ipaddr="192.168.130.4"/>
</method>
</fence>
</clusternode>
<clusternode name="node1" nodeid="2"
votes="1">
<fence>
<method name="single">
<device name="human"
ipaddr="192.168.130.6"/>
</method>
</fence>
</clusternode>
</clusternodes>
<cman expected_votes="1" two_node="1"/>
<fencedevices>
<fenve_device name="human"
agent="fence_manual"/>
</fencedevices>
<rm>
<failoverdomains/>
<resources/>
</rm>
</cluster>
This cluster.conf must be the same on both node1 and node2. So copy it over:
Ex: scp /etc/cluster/cluster.conf root at node1:/etc/cluster.
Now start cam on both nodes:
cman start.
Now expect this:
[root at node1 cluster]# service cman start
Starting cluster:
Enabling workaround for Xend bridged networking... done
Loading modules... done
Mounting configfs... done
Starting ccsd... done
Starting cman... done
Starting daemons... done
Starting fencing... done
[ OK ]
Now check if all is running well:
Check nodes like this: cman_tool nodes
[root at node1 cluster]# cman_tool nodes
Node Sts Inc Joined Name
1 M 12 2010-08-05 08:37:22 node2
2 M 4 2010-08-05 08:37:22 node1
Now we make our clustered filesystem.
Do it exactly like that:
Now first on node1:
For this we need the name of our cluster in cluster.conf, ?samba-cluster?, and
?/dev/drbd0?.
mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0.
[root at node1 cluster]# mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2
/dev/drbd0
This will destroy any data on /dev/drbd0.
Are you sure you want to proceed? [y/n]
Device: /dev/drbd0
Blocksize: 4096
Device Size 465.75 GB (122092264 blocks)
Filesystem Size: 465.75 GB (122092262 blocks)
Journals: 2
Resource Groups: 1863
Locking Protocol: "lock_dlm"
Lock Table: "samba-cluster:gfs2"
UUID: BBAF2EC1-B0B8-0F82-DB5C-CA9273859610
Then service gfs start.
Then change on node2. Remember this node runs in drbd ?secondary?. So we have to
put it on primary.
On node2:
drbdadm primary r0.
A cat /proc/drbd must show us:
cat /proc/drbd
version: 8.3.8 (api:88/proto:86-94)
GIT-hash: d78846e52224fd00562f7c225bcc25b2d422321d build by mockbuild at
builder10.centos.org, 2010-06-04 08:04:31
0: cs:Connected ro:Primary/Primary ds:UpToDate/UpToDate C r----
ns:0 nr:488671336 dw:488671336 dr:0 al:0 bm:29808 lo:0 pe:0 ua:0 ap:0 ep:1
wo:b oos:0
Now we can make on node2 our clustered filesystem:
[root at node2 ~]# mkfs.gfs2 -t samba-cluster:gfs2 -p lock_dlm -j 2 /dev/drbd0
This will destroy any data on /dev/drbd0.
It appears to contain a gfs2 filesystem.
Are you sure you want to proceed? [y/n]
Device: /dev/drbd0
Blocksize: 4096
Device Size 465.75 GB (122092264 blocks)
Filesystem Size: 465.75 GB (122092262 blocks)
Journals: 2
Resource Groups: 1863
Locking Protocol: "lock_dlm"
Lock Table: "samba-cluster:gfs2"
UUID: 885E2E87-90CE-B916-8A73-D66336CD98C0
Now start on node2 gfs: service gfs start.
No make on both nodes in / the directory windows: mkdir windows.
Then mount on both nodes the gfs filesystem to windows:
mount -t gfs2 /dev/drbd0 /windows.
Now lets do testing, on nod1:
cd /windows.
touch test.txt
[root at node1 windows]# ls
test.txt
On node2 you must see in /windows:
[root at node2 windows]# ls
test.txt.
On node2: vim test.txt, i, this is a test from node2,:, wq.
On node1: /cat/windows/test.txt
[root at node1 windows]# cat /windows/test.txt
this is a test from node2
So you did it. Everything is synchronized.
So you point hour home-directories and your shares in
/usr/local/samba/etc/smb.conf to a directory in windows and you have a failover
Data for your both samba4 controllers.
The next thing to do is to add entries into fstab on both nodes :
vim /etc/fstab
Enter: /dev/drbd0 /windows gfs2 _netdev 0 0
At the end.
This is my fstab:
/dev/VolGroup00/LogVol00 / ext3 defaults 1 1
LABEL=/boot /boot ext3 defaults 1 2
tmpfs /dev/shm tmpfs defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
sysfs /sys sysfs defaults 0 0
proc /proc proc defaults 0 0
/dev/VolGroup00/LogVol01 swap swap defaults 0 0
/dev/drbd0 /windows gfs2 _netdev 0 0
The next step is to make shure DRBD is started on boot before GFS2. In my case I
tried several hours befor I succeeded. You must do this on both nodes.
You find the startup scripts in /etc/rc.d/init.d.
First drbd: vim drbd. You find the start and stop option at #chkconfig_ - start
stop.
The original line here: #chkconfig: - 70 08. I changed it to: # chkconfig: - 55
08
#!/bin/bash
#
# chkconfig: - 55 08
# description: Loads and unloads the drbd module
#
# Copyright 2001-2010 LINBIT
#
# Philipp Reisner, Lars Ellenberg
#
### BEGIN INIT INFO
# Provides: drbd
# Required-Start: $local_fs $network $syslog
# Required-Stop: $local_fs $network $syslog
# Should-Start: sshd multipathd
# Should-Stop: sshd multipathd
# Default-Start: 2 3 4 5
# Default-Stop: 0 1 6
# X-Start-Before: heartbeat corosync
# X-Stop-After: heartbeat corosync
# Short-Description: Control drbd resources.
### END INIT INFO
Now vim gfs2:
The original line here: #chkconfig: - 26 74. I changed it to: # chkconfig: - 70
07
#!/bin/bash
#
#
#
# chkconfig: - 70 07
# description: mount/unmount gfs2 filesystems configured in /etc/fstab
#
#
### BEGIN INIT INFO
# Provides:
### END INIT INFO
:q
:
Now cd /etc/rc.d/rc5.d.
mv S26gfs2 S70gfs2
mv S70drbd S55drbd
in all other rc0.d-rc4.d and rc.6.d, mv K74gfs2 K07gfs2
Now restart both nodes.
Mkdir /windows/homes on both nodes.Point your [homes] in
/usr/local/samba/etc/smb.conf to path= /windows/homes:
[homes]
path= /windows/homes
read only=no
Make as described in Step3: Add home derictories and rights. You will find your
files synchronized on both node1 und node2
Now important to make your simple failover work you have to tune your named
server on node1:
This are the entries for your /usr/local/samba/private/dns/yourdomianzone
EX mine : /usr/local/samba/private/dns/tuebingen.tst.loc.zone
Change it according your settings:
; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@ IN SOA @ hostmaster (
2010080911 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS node1
IN A 192.168.134.27
IN A 192.168.134.28
;192.168.134.28 eingefuegt
;
node1 IN A 192.168.134.27
node2 IN A 192.168.134.28
gc._msdcs IN A 192.168.134.27
13ff0be8-50f6-45b8-858e-9a38872906e0._msdcs IN CNAME node1
aaf6380d-162e-4263-86b2-c4119457342c._mscds IN CNAME node2
;
; global catalog servers
_gc._tcp IN SRV 0 100 3268 node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 node1
_ldap._tcp.gc._msdcs IN SRV 0 100 3268 node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp IN SRV 0 100 389 node1
_ldap._tcp IN SRV 0 100 389 node2
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node2
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node1
;von mir eingefuegt
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node2
;ende
_ldap._tcp.fac1d707-a9a9-44a2-8b02-4ab6dda8cec7.domains._msdcs IN SRV 0
100 389 node1
_ldap._tcp.fac1d707-a9a9-44a2-8b02-4ab6dda8cec7.domains._msdcs IN SRV 0
100 389 node2
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node2
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node2
;
; krb5 servers
_kerberos._tcp IN SRV 0 100 88 node1
_kerberos._tcp IN SRV 0 100 88 node2
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node2
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node2
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node2
_kerberos._udp IN SRV 0 100 88 node1
_kerberos._udp IN SRV 0 100 88 node2
; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp IN SRV 0 100 88 node1
_kerberos-master._tcp IN SRV 0 100 88 node2
_kerberos-master._udp IN SRV 0 100 88 node1
_kerberos-master._udp IN SRV 0 100 88 node2
;
; kpasswd
_kpasswd._tcp IN SRV 0 100 464 node1
_kpasswd._tcp IN SRV 0 100 464 node2
_kpasswd._udp IN SRV 0 100 464 node1
_kpasswd._udp IN SRV 0 100 464 node2
;
; heimdal 'find realm for host' hack
_kerberos IN TXT TUEBINGEN.TST.LOC
Now make your Netlogon failover:
On node1:
This will sync scripts to node2 on the fly.
Put your logins script there ex: login.cmd
My netlogon resides here:
Attention be shure to put the right rights here to the sysvol directory
On both nodes this has to be root:wheel!!!!!!!!!!!!!!
Cd /usr/local/samba/var/locks/sysvol/tuebingen.tst.loc
Cp ?r scripts /windows
Chown ?R root:wheel /windows/scripts.
mv scripts scripts.org.
ln ?s /windows/scipts scripts.
Chown ?R root:wheel scripts.
On node2:
Important on node2, I had to do a chown ?R root:wheel to
/usr/local/samba/var/locks/sysvol
In /usr/local/samba/var/locks/sysvol/tuebingen.tst.loc
Mv scripts scripts.org
Ln ?s /windows/scripts scripts
Chown root:wheel scripts
Next step about Policies:
node1:
/usr/local/samba/var/locks/sysvol/tuebingen.tst.loc/Policies.
On node1: cd /usr/local/samba/var/locks/sysvol/tuebingen.tst.loc/
cp ?r Policies /windows
chown ?R root:wheel /windows/Policies
mv Policies Policies.org
ln ?s /windows/Policies Policies
chown ?R root:wheel Policies
node2:
If you have not done it before:
chown ?R root:wheel /usr/local/samba/var/locks/sysvol
cd /usr/local/samba/var/locks/sysvol/tuebingen.tst.loc:
On node2 as the 2nd dc there was done no Policies-directory.
Now: ln ?s /windows/Policies Policies
Chown ?R root:wheel Policies
[root at node2 tuebingen.tst.loc]# ls -la
insgesamt 12
drwxr-xr-x 3 root wheel 4096 12. Aug 11:22 .
drwxr-xr-x 3 root wheel 4096 11. Aug 15:37 ..
lrwxrwxrwx 1 root wheel 17 12. Aug 11:22 Policies -> /windows/Policies
lrwxrwxrwx 1 root wheel 16 11. Aug 15:46 scripts -> /windows/scripts
drwxr-xr-x 2 root wheel 4096 11. Aug 15:37 scripts.old
Step 5 Making dns available Master/Slave- Server:
The next step will be making the DNS-Server on node1 the master and the one on
node2 the secondary (slave) server. And we create a reverse Zone.
So when you put to your windows clients: node1 as your first dns and node 2 as
your second your domain will always be found as long one of the server are
running.
Now on node1: Remember we point in our /etc/named.conf to our dns-samba-file in
/usr/local/samba/private/named.conf. We have to change a little in this
/usr/local/samba/private/named.conf:
# This file should be included in your main BIND configuration file
#
# For example with
# include "/usr/local/samba/private/named.conf";
zone "tuebingen.tst.loc." IN {
type master;
file "/usr/local/samba/private/dns/tuebingen.tst.loc.zone";
/*
* the list of principals and what they can change is created
* dynamically by Samba, based on the membership of the domain
controllers
* group. The provision just creates this file as an empty file.
*/
include "/usr/local/samba/private/named.conf.update";
/* we need to use check-names ignore so _msdcs A records can be created
*/
check-names ignore;
allow-transfer { 192.168.134.28; };#<----------------
};
# The reverse zone configuration#<--------------reverse starts here
zone "134.168.192.in-addr.arpa" in {
type master;
file
"/usr/local/samba/private/dns/134.168.192.in-addr.arpa.zone";
allow-transfer { 192.168.134.28; };
update-policy {
grant *.TST.LOC wildcard *.134.168.192.in-addr.arpa. PTR;
};
};
Look at my file: allow-transfer { 192.168.134.28; };. Allow ?transfer here you
must fit to your node2. This IP is allowed to pull a copy of the zone files.
The reverse zone configuration, take it as example. I choosed a 192.168.134
subnet here, and I put the file exactly where the sama-dns-file was created.
[root at node1 dns]# ls -la
insgesamt 28
drwxrwxr-x 2 named named 4096 14. Aug 10:48 .
drwxr-xr-x 7 root root 4096 16. Aug 09:15 ..
-rwxrwxrwx 1 named named 626 13. Aug 09:34 134.168.192.in-addr.arpa.zone
-rwxrwxrwx 1 named named 2977 13. Aug 12:25 tuebingen.tst.loc.zone
There goes all the Clients in this Subnet. You have to do it manually.
EX: My 134.168.192.in-addr.arpa.zone:
$ORIGIN 134.168.192.in-addr.arpa.
$TTL 1W
@ IN SOA tuebingen.tst.loc. root.tuebingen.tst.loc. (
01 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS node1.tuebingen.tst.loc.
IN NS node2.tuebingen.tst.loc.
27 IN PTR node1.tuebingen.tst.loc.
28 IN PTR node2.tuebingen.tst.loc.
Now my samba-dns-file: We have two dns!!!
[root at node1 dns]# cat tuebingen.tst.loc.zone
; -*- zone -*-
; generated by provision.pl
$ORIGIN tuebingen.tst.loc.
$TTL 1W
@ IN SOA @ hostmaster (
2010081113 ; serial
2D ; refresh
4H ; retry
6W ; expiry
1W ) ; minimum
IN NS node1
;secondary eintrag
IN NS node2 #<---secondary dns
IN A 192.168.134.27
IN A 192.168.134.28
;
node1 IN A 192.168.134.27
node2 IN A 192.168.134.28
gc._msdcs IN A 192.168.134.27
02284f45-de16-4125-a795-3b614f540ef7._msdcs IN CNAME node1
a441f8f9-629d-43c4-bce6-a5dfba1e4ad9._mscds IN CNAME node2
;
; global catalog servers
_gc._tcp IN SRV 0 100 3268 node1
_gc._tcp.Default-First-Site-Name._sites IN SRV 0 100 3268 node1
_ldap._tcp.gc._msdcs IN SRV 0 100 3268 node1
_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs IN SRV 0 100 3268 node1
;
; ldap servers
_ldap._tcp IN SRV 0 100 389 node1
_ldap._tcp IN SRV 0 100 389 node2
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.dc._msdcs IN SRV 0 100 389 node2
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.pdc._msdcs IN SRV 0 100 389 node2
;Eintrag fuer pdc
_ldap._tcp.3d718df6-359c-4eb4-a0de-5a7aaf5b0d26.domains._msdcs IN SRV 0
100 389 node1
_ldap._tcp.3d718df6-359c-4eb4-a0de-5a7aaf5b0d26.domains._msdcs IN SRV 0
100 389 node2
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites IN SRV 0 100 389 node2
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node1
_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 389 node2
;
; krb5 servers
_kerberos._tcp IN SRV 0 100 88 node1
_kerberos._tcp IN SRV 0 100 88 node2
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.dc._msdcs IN SRV 0 100 88 node2
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites IN SRV 0 100 88 node2
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node1
_kerberos._tcp.Default-First-Site-Name._sites.dc._msdcs IN SRV 0 100 88 node2
_kerberos._udp IN SRV 0 100 88 node1
_kerberos._udp IN SRV 0 100 88 node2
; MIT kpasswd likes to lookup this name on password change
_kerberos-master._tcp IN SRV 0 100 88 node1
_kerberos-master._tcp IN SRV 0 100 88 node2
_kerberos-master._udp IN SRV 0 100 88 node1
_kerberos-master._udp IN SRV 0 100 88 node2
;
; kpasswd
_kpasswd._tcp IN SRV 0 100 464 node1
_kpasswd._tcp IN SRV 0 100 464 node2
_kpasswd._udp IN SRV 0 100 464 node1
_kpasswd._udp IN SRV 0 100 464 node2
;
; heimdal 'find realm for host' hack
_kerberos IN TXT TUEBINGEN.TST.LOC
Now we switch over to node2:
We have to create the dns directory in /usr/local/samba/private:
mkdir /usr/local/samba/private/dns.
Chown ?R named:named /usr/local/samba/private/dns.
Chmod ?R 770 /usr/local/samba/private/dns.
Copy over /usr/local/samba/private/named.conf to your node2.
scp /usr/local/samba/private/named.conf root at node2:/usr/local/samba/private.
Then we have to edit this file. It should look like this:
zone "tuebingen.tst.loc." IN {
type slave; #<----------we mark it as slave
file "/usr/local/samba/private/dns/tuebingen.tst.loc.zone";
masters { 192.168.134.27; };#<---we tell him were to pull the zone
/*
* the list of principals and what they can change is created
* dynamically by Samba, based on the membership of the domain
controllers
* group. The provision just creates this file as an empty file.
*/
//and we had to remove the update section because a slave cannot.
//include "/usr/local/samba/private/named.conf.update";
/* we need to use check-names ignore so _msdcs A records can be created
*/
check-names ignore;
};
# The reverse zone configuration is optional. The following example assumes a
# subnet of 192.168.123.0/24:
zone "134.168.192.in-addr.arpa" in {
type slave;
file
"/usr/local/samba/private/dns/134.168.192.in-addr.arpa.zone";
masters { 192.168.134.27; };
};
Now make shure /usr/local/samba/private/named.conf has the rights, named:named.
Chown named:named /usr/local/samba/private/named.conf.
And also your /etc/named.conf points to that file:
// named.conf
options {
listen-on port 53 { 127.0.0.1;192.168.134.28; };
listen-on-v6 port 53 { ::1; };
directory "/var/named";
dump-file "/var/named/data/cache_dump.db";
statistics-file "/var/named/data/named_stats.txt";
memstatistics-file "/var/named/data/named_mem_stats.txt";
allow-query { localhost; 192.168.135.0/24; 192.168.134.0/24; };
recursion yes;
forwarders { 192.168.134.253; };
};
logging {
channel default_debug {
file "data/named.run";
severity dynamic;
};
};
zone "." IN {
type hint;
file "named.ca";
};
#versuch raus genommen
include "/usr/local/samba/private/named.conf"; #<---make it point
the right way
include "/etc/named.rfc1912.zones";
Now restart both dns-servers.
On node2 you will find now in /usr/local/samba/private/dns:
-rw-r--r-- 1 named 500 406 15. Aug 00:51 134.168.192.in-addr.arpa.zone
-rw-r--r-- 1 named 500 2680 15. Aug 08:46 tuebingen.tst.loc.zone
Maybe Matching Threads
- WG: HOWTO samba4 centos5.5 named dnsupdate drbd simple failover
- WG: HOWTO samba4 centos5.5 named dnsupdate drbd simple failover
- samba 4 dns-update issue
- HOWTO centOS 5.5 samba4 dns dynamic update/Replication
- WG: Running 2 SAMBA4 DC Replication WERR_BADFILE error